Several government websites use a range of eMudhra’s keys to “sign” their security certificates, which is necessary for any website to display on a modern browser.
LONDON – A major cybersecurity scare jolted internet after AI uncovered two critical PHP security flaws reportedly hidden for over a decade.
From government portals to major platforms including BBC and Wikipedia, websites faced disruptions as authorities raced to patch vulnerabilities that could potentially put millions of online services at risk.
A major cybersecurity scare has sent shockwaves across the internet, forcing government agencies, media organisations and major online platforms to temporarily shut down services after artificial intelligence helped uncover two potentially devastating security vulnerabilities in PHP, the programming language used by millions of websites worldwide.
The discovery triggered urgent warnings from cybersecurity agencies across several countries, with organisations advised to install emergency security patches or consider taking vulnerable websites offline to prevent possible cyberattacks.
The vulnerabilities, reportedly hidden in PHP for more than a decade, were identified within weeks using advanced artificial intelligence tools. Security fixes were released on Wednesday afternoon, but concerns intensified after details of the flaws leaked on social media a day earlier.
The cybersecurity alert has prompted precautionary shutdowns across multiple countries, including Finland, the Netherlands and the United Kingdom. Finland temporarily suspended public-facing government web services, while the Netherlands’ national cybersecurity agency also took its website offline.
In Britain, Edinburgh City Council’s website was affected, alongside several BBC programme websites, including those associated with Doctor Who and The Traitors. Wikipedia users also encountered access problems on Wednesday after the Wikimedia Foundation confirmed that it was taking protective measures against the newly discovered vulnerabilities.
The foundation said several additional systems had been temporarily disabled until they could be safely updated. However, not every reported website disruption has been conclusively linked to the PHP security flaws. Some organisations have yet to establish or publicly confirm the precise causes of their outages.
The online art platform DeviantArt also displayed a temporary maintenance notice without explaining whether the shutdown was related to the wider cybersecurity alert.
US National Security Agency (NSA) issued an urgent advisory recommending that organisations unable to deploy security updates immediately consider temporarily disabling potentially vulnerable systems. According to the agency, the flaws could allow attackers to gain direct access to server file systems or databases, potentially exposing sensitive information and critical infrastructure.
The White House also acknowledged the seriousness of the situation, saying federal agencies were collaborating with leading artificial intelligence companies to accelerate efforts to address the vulnerabilities.
One of the key aspects of cybersecurity scare is how the vulnerabilities were discovered. Researchers from cybersecurity companies Calif and Wiz reportedly identified the flaws through OpenAI’s “Patch the Planet” initiative, which provides experts with advanced AI tools to identify and resolve weaknesses in widely used programming languages.
According to reports, the vulnerabilities had escaped detection for more than ten years before AI-assisted researchers uncovered them within weeks. OpenAI described the discovery in a blog post as one of the most significant cybersecurity issues identified in recent years. Wiz characterised the flaws as among the most serious vulnerabilities discovered with the assistance of artificial intelligence.
The potential scale of the threat has raised particular concern because PHP remains one of the world’s most widely used server-side programming languages. Wiz estimated that roughly 70 percent of the internet could fall within the broader potential exposure associated with PHP’s widespread adoption.
The timing of the disclosure has added another layer of urgency. PHP Foundation had reportedly intended to publish full technical details and comprehensive security fixes later this month, allowing organisations additional time to prepare.
Those plans changed when information about the vulnerabilities surfaced on social media on Tuesday, raising fears that attackers could exploit the weaknesses before protective updates were widely deployed.
Emergency security fixes were subsequently released on Wednesday afternoon, while cybersecurity authorities urged organisations to act without delay.
The incident shows growing reality of the digital age, as AI is becoming strong weapon for identifying hidden software vulnerabilities, but the same technological advances could also help malicious actors discover and exploit security weaknesses.
For two decades, data centers were relatively safe, lucrative real estate investments. They attracted investors because they served as digital infrastructure — the essential plumbing that keeps the internet running. The growth of artificial intelligence (AI) and its increased demands on computing power has meant data centre builders are in a race to build out […]
The European Union has taken a significant step towards revising its digital regulatory framework after member states agreed proposals to amend the General Data Protection Regulation (GDPR), simplify cookie consent requirements and overhaul cybersecurity reporting obligations.
The measures form part of the European Commission’s Digital Omnibus package, introduced in November 2025, and represent one of Brussels’ most substantial attempts to simplify the regulatory obligations imposed on businesses operating across the single market.
Changes to GDPR and personal data rules
The proposed reforms would modify several provisions of the GDPR, which has governed the processing of personal data across the EU since May 2018.
Rather than replacing the legislation, the Council wants to clarify existing obligations, particularly those concerning pseudonymised information, requests for access to personal data and the use of information in scientific research.
The agreed position retains the existing definition of personal data while introducing provisions intended to clarify when pseudonymised information can be linked to an identifiable individual.
Companies would also benefit from simplified procedures for handling manifestly unfounded or excessive data requests and from reduced information requirements in certain low-risk circumstances.
Another proposed change would extend the deadline for notifying authorities of personal data breaches, while establishing more consistent reporting templates across the EU.
For multinational companies, which currently navigate different interpretations of data protection obligations by national authorities, these provisions could reduce compliance costs and administrative duplication.
However, the changes have raised concerns among European privacy regulators.
In a joint opinion published in February, the European Data Protection Board and European Data Protection Supervisor warned that parts of the Commission’s original proposal could create legal uncertainty and undermine existing protections.
They were particularly concerned about proposals affecting the definition of personal data and the Commission’s potential role in determining when pseudonymised information falls outside GDPR requirements.
The Council’s decision to retain the existing definition addresses part of that debate, although the final legislative text remains subject to negotiations.
Fewer cookie banners for internet users
One of the most visible changes would affect the consent notices encountered by Europeans when visiting websites.
Under the Council’s proposal, additional categories of cookies and similar tracking technologies could be used without obtaining explicit consent, provided the relevant legal conditions are satisfied.
The proposed exemptions include technologies necessary to deliver a service, maintain device security or conduct audience measurement.
For website operators, publishers and online businesses, the changes could reduce the number of consent requests displayed to visitors and simplify technical compliance.
The current system has generated extensive legal disputes over whether consent is genuinely voluntary and whether tracking technologies collect information beyond what users have authorised.
The latest proposal would not abolish consent requirements for commercial tracking or behavioural advertising. Technologies falling outside the permitted exemptions would remain subject to the applicable privacy rules.
Cybersecurity reporting and artificial intelligence
The package also addresses the growing number of reporting obligations imposed on European businesses under overlapping cybersecurity legislation.
The Commission originally proposed a single European reporting mechanism for certain data and cybersecurity incidents.
Member states have instead agreed to establish national entry points, supported by an EU-level information system and provisions for coordinating cross-border notifications.
The Council’s position would also clarify the legal grounds for certain uses of personal data in artificial intelligence systems and introduce safeguards for processing sensitive information in specified circumstances.
These provisions follow increasingly complicated disputes over the application of European privacy legislation to AI development and automated decision-making.
The Commission estimates that its wider digital simplification initiative could save European businesses up to €5 billion in administrative costs by 2029.
The initiative reflects pressure from European governments and business organisations to reduce the regulatory fragmentation that makes operating across multiple EU jurisdictions more expensive.
The Digital Omnibus is part of a broader legislative programme influenced by the competitiveness reports produced by former Italian prime ministers Enrico Letta and Mario Draghi.
Under the Council’s negotiating mandate, several existing data-related rules would also be consolidated, while provisions governing the protection of trade secrets would be strengthened.
The European Parliament must now determine its negotiating position before formal discussions between the institutions can begin. Until the legislation is agreed and adopted, existing GDPR, cookie consent and cybersecurity requirements remain in force.
As governments and corporations alike scramble to install a patch to fix fundamental security flaws in a programming language that helps run roughly 70 percent of the world's websites, here's what you need to know about how AI has helped bring these critical vulnerabilities to light.
The class-action suit has been filed on behalf of eight plaintiffs, who allege they were harmed by Meta while they were under the age of 18, and are seeking compensation
Government and corporate websites were shut down across the world overnight into Wednesday after cybersecurity firms used artificial intelligence to reveal critical flaws in widely used programming language PHP. PHP programmers on Wednesday released a patch fixing the vulnerability.
Musk says ‘there’s a lot of merit’ to potential merger that would require approval of 50% of all Tesla shareholders, but he declined to elaborate
Investors were paying close attention to Tesla’s third-quarter earnings call on Wednesday afternoon, after chief executive Elon Musk floated the idea of merging the car company with his rocket and AI company, SpaceX. But they didn’t glean further information after the company announced there would be no questions on the matter.
“With regard to a potential merger with SpaceX, I think I said everything that should be said yesterday,” Musk, the CEO of both companies, said on Tesla’s earnings call. He repeated a phrase he said on Tuesday: “I feel like I’m tap dancing through a minefield.”
A report from a cybersecurity firm estimated that the software flaw had existed undetected for more than a decade, but AI tools helped quickly identify a fix for them.
A report from a cybersecurity firm estimated that the software flaw had existed undetected for more than a decade, but AI tools helped quickly identify a fix for them.
A New Mexico judge ordered Meta to pay $25 billion after a jury found the company deceived users in a case linked to the Cambridge Analytica scandal, media reported Wednesday. The ruling follows an $18 billion settlement with 48 other states over similar claims. Meta called the penalty “a tax on speech".
The verdict should be seen as a warning for tech companies that New Mexico will hold them accountable, state Attorney General Raúl Torrez said at a news conference.
The National Security Agency (NSA) warned organizations Wednesday to immediately patch a pair of security flaws or take their systems offline after artificial intelligence discovered vulnerabilities in a key programming language. “Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities,” the NSA’s cyber…
Login
